CVE-2026-6017 Overview
CVE-2026-6017 is an information disclosure vulnerability in KAON PG5298A and PG5298B routers. The firmware exposes a specific endpoint that any unauthenticated user on the adjacent network can query. The endpoint returns sensitive information, including the administrative portal password. An attacker who reaches the device from the local network segment can retrieve credentials and take full control of router administration. The issue is tracked under CWE-306: Missing Authentication for Critical Function. KAON addressed the flaw in firmware 3.0.82 for PG5298A and firmware 4.0.82 for PG5298B.
Critical Impact
Unauthenticated adjacent attackers can retrieve the administrative password from vulnerable KAON routers, leading to full device takeover.
Affected Products
- KAON PG5298A router firmware prior to 3.0.82
- KAON PG5298B router firmware prior to 4.0.82
Discovery Timeline
- 2026-08-24 - CVE-2026-6017 published to the National Vulnerability Database (NVD)
- 2026-08-24 - Last updated in NVD database
Technical Details for CVE-2026-6017
Vulnerability Analysis
The vulnerability resides in the router web management stack. A specific HTTP endpoint returns sensitive configuration data, including the administrator password, without enforcing authentication. Any client with network reachability to the router management interface can issue the request and read the response.
This behavior corresponds to CWE-306, where a critical function is exposed without an access control check. The attack vector is adjacent network, meaning the attacker must share the same broadcast domain or logical network segment as the router. In practice this includes attackers on the wireless LAN, a wired LAN port, or any pivoted host on the internal network.
After retrieving the administrative password, an attacker authenticates to the portal and can modify routing, DNS, firewall, and Wi-Fi settings. Downstream impact includes traffic interception, DNS hijacking, and persistent implant staging on the network edge.
Root Cause
The firmware endpoint that discloses credential data lacks an authentication or authorization gate. Sensitive administrative data is served in the response body regardless of session state.
Attack Vector
Exploitation requires only network access to the router management interface. No credentials, no user interaction, and no elevated privileges are required. See the CERT Poland analysis for the technical write-up and endpoint context.
Vulnerability details are described in prose above.
No verified public exploit code is available at time of writing.
Detection Methods for CVE-2026-6017
Indicators of Compromise
- Unexpected HTTP GET requests from LAN or Wi-Fi clients to the router administrative interface targeting configuration or diagnostic endpoints.
- Successful administrative logins to the router portal from client IPs that do not belong to IT staff.
- Configuration drift on the router, such as changed DNS servers, new port forwards, or altered Wi-Fi credentials.
Detection Strategies
- Inspect router access logs for anonymous requests to configuration endpoints followed by administrative logins from the same source.
- Compare current router configuration against a known-good baseline to identify unauthorized changes to DNS, firewall, and remote management settings.
- Monitor DHCP and ARP tables for unrecognized devices on segments that can reach the router management VLAN.
Monitoring Recommendations
- Forward router syslog and authentication events to a central log platform and alert on administrative logins from non-admin subnets.
- Alert on DNS resolver changes originating from network gateway devices, which often follow a credential-disclosure compromise.
- Track outbound traffic from the router itself for anomalous callbacks that would indicate firmware or configuration tampering.
How to Mitigate CVE-2026-6017
Immediate Actions Required
- Upgrade PG5298A units to firmware 3.0.82 and PG5298B units to firmware 4.0.82 or later.
- Rotate the administrative portal password on every affected router after the firmware upgrade, since credentials may already be exposed.
- Review router configuration for unauthorized changes, especially DNS, remote management, port forwarding, and VPN settings.
Patch Information
KAON has released fixed firmware. Install version 3.0.82 for PG5298A and version 4.0.82 for PG5298B. Refer to the CERT Poland advisory for vendor references and firmware distribution details.
Workarounds
- Restrict access to the router management interface using ACLs so that only a dedicated management VLAN or specific admin hosts can reach it.
- Disable Wi-Fi guest network access to the administrative interface and place IoT devices on a separate SSID and VLAN.
- Where feasible, isolate the router management plane from user segments until firmware can be updated.
# Example: restrict router management interface to a management subnet
# Replace 192.0.2.0/24 with your management network
iptables -A INPUT -i br-lan -p tcp --dport 443 -s 192.0.2.0/24 -j ACCEPT
iptables -A INPUT -i br-lan -p tcp --dport 443 -j DROP
iptables -A INPUT -i br-lan -p tcp --dport 80 -s 192.0.2.0/24 -j ACCEPT
iptables -A INPUT -i br-lan -p tcp --dport 80 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
